Frequently Asked Questions: Background Screening for Employers

Hiring someone is a process that all HR teams go through and know very well. You’re welcoming a future team member who will have access to your clients, your data, and sometimes even your reputation, all based on the strength of a CV and a good interview. Background screening is how employers turn the process into an informed decision.

But the hiring legislation aren’t the same everywhere. What’s routine in the US can put you in front of a data protection regulator in Romania. What’s legally required in the UK might be optional across the Atlantic. If you hire across borders (and more HR teams do every year), one screening policy copied and pasted into every country is can create some difficult situations.

This FAQ answers the questions we hear most from HR teams, compliance officers, and hiring managers, with the specifics for Romania, the UK, and the US laid out side by side.

One caveat before we start: this is general guidance, not legal advice. Rules shift and local detail matters, so treat it as a solid starting point for a conversation with your screening partner or counsel.

Here is the AI podcast if you want to listen to it:

What is background screening?

Background screening is the structured process of verifying that a candidate is who they say they are, and that the claims on their CV hold up. In practice that usually means checking identity, employment history, education and qualifications, professional references, and, where the role and the law allow, criminal records. Some positions add credit checks, professional licence verification, or sanctions and media screening.

The goal is not to catch candidates. It is to confirm the facts, ensure they meet the role’s requirements, and support their successful integration into the team. Consider a finance hire who inflated a qualification, a driver who failed to disclose a relevant record, or a caregiver who does not have clearance to work with vulnerable people. Screening identifies these risks early, when employers can make a considered decision rather than respond to a crisis.

Worth saying plainly: screening verifies information, it doesn’t dig for dirt. Good screening is narrow, relevant to the job, and proportionate. Everything below flows from that one idea.

Is background screening common?

Short answer: yes, and it’s growing in all three markets, though the maturity differs.

Across the United States, pre-employment screening is standard practice, particularly for roles involving financial responsibilities, sensitive data, vehicles, or vulnerable individuals. In the UK, certain checks go beyond common practice and are legally required: every employer must verify a new hire’s right to work, without exception. Meanwhile, in Romania, candidate screening has grown steadily as employers in IT, BPO, banking, and healthcare have become more aware of résumé fraud risks and the true cost of a poor hiring decision.

What’s influencing it? Remote hiring made backgrounds easier to fake and harder to verify. CV fraud is up. And in regulated sectors, supervisors expect employers to know exactly who they’re hiring. Screening has quietly moved from “nice to have” to “part of doing this properly.”

What Information Can Employers Legally Consider?

Across the US, UK, and Romania, employers should generally limit pre-employment screening to information that is relevant and proportionate to the role. The information requested should have a clear connection to the candidate’s ability to perform the job or meet a legal requirement.

About standard employment verification checks, the following are usually appropriate across all three countries when they are relevant to the position:

• Identity and right-to-work verification
• Employment history and previous roles
• Education, professional licences, and qualifications
• Professional references
• Role-specific skills, certifications, or memberships

Employers should collect only the information needed for the stated purpose and avoid requesting data simply because it may be available.

Additional legal considerations apply when screening involves more sensitive information, including:

• Criminal records
• Credit history or financial information
• Health and medical information
• Social media activity
• Information relating to race, religion, disability, sexual orientation, or political views

Employers should carry out these checks only when the law permits them and when they are necessary and proportionate to the role. They must also comply with local requirements on data protection, candidate notification, consent where applicable, and non-discrimination.

At the same time, it is important to take a role-based approach by:

How do data protection and background check laws impact screening?

This is where the three jurisdictions genuinely diverge.

In Romania and the UK, screening sits under data protection law: the EU GDPR plus Law 190/2018 in Romania, and the UK GDPR plus the Data Protection Act 2018 in Britain. Both expect you to identify a valid legal basis for processing someone’s data before you start, and to be transparent about it through a privacy notice.

Here’s a common misconception: “you just need the candidate’s consent.” In an employment context, consent is mandatory but, because the power imbalance between an employer and an applicant makes it hard to argue the consent was truly free (say no, risk the job). Regulators like the ICO expect the real legal basis to be legitimate interest, a legal obligation, or necessity for entering the contract, with consent in a supporting role.

Now, let’s look at the part that often causes confusion. In both Romania and the UK, employers, and screening providers like us, must obtain signed, informed consent from candidates. This consent clearly outlines exactly what will be checked, and no background verification can proceed without it. That’s correct and necessary. The nuance is what that document does. It authorizes the check and evidences transparency; however, it is not, by itself, what makes the data processing lawful. You need a proper legal basis behind it, and for criminal records especially, consent is never enough on its own (more in Q5).

The US runs on a different logic entirely. No GDPR. The key federal law is the Fair Credit Reporting Act (FCRA), and if you use a third-party screening company (a “consumer reporting agency”), you must give the candidate a standalone written disclosure and get their written authorization before running the check. Here, as well, written permission it’s mandatory. Skipping this step can expose your organisation to litigation.

Jurisdiction	Main law + regulator	Signed consent?	Primary legal basis
Romania	EU GDPR + Law 190/2018; ANSPDCP	Yes, informed and written (in practice)	Legitimate interest / legal obligation / contract
UK	UK GDPR + Data Protection Act 2018; ICO	Yes, informed written consent is standard	Art. 6 basis + DPA condition; not consent alone for criminal data
US	FCRA (federal) + state law; FTC/CFPB, EEOC	Yes, written authorization legally required (via a CRA)	Statutory compliance (FCRA) + job-relatedness

Can employers request criminal records ?

Yes, but employers must follow stricter rules for criminal-record checks in all three countries. They should request criminal-record information only when the role justifies it and the law allows it.

Romania

In Romania, employers should request or process a criminal record certificate (cazier judiciar) only where a specific legal requirement applies to the position. This may include roles in private security, transport, certain regulated professions, healthcare, or work involving children.

For most standard roles, requesting a criminal record without a clear legal basis can create GDPR compliance risks. Criminal-conviction data receives additional protection under Article 10 of the GDPR. A more data-minimising approach may be to ask the candidate to present a valid certificate and record only the relevant outcome—for example, whether they meet the legal eligibility requirement—rather than retaining a copy.

United Kingdom

In the UK, employers obtain criminal-record checks through the Disclosure and Barring Service DBS. The role determines which level of check an employer can request.

Employers can request a Basic DBS check for any role. It shows unspent convictions and conditional cautions. They can request Standard or Enhanced checks only for eligible roles, including positions that involve children, vulnerable adults, or certain regulated professions. Employers cannot use an Enhanced check for a general office role simply as a precaution.

Employers that carry out DBS checks must also maintain a policy on recruiting ex-offenders and provide it to applicants on request. gov

The Rehabilitation of Offenders Act 1974 generally allows applicants to withhold information about spent convictions. It also prevents employers from considering those convictions in hiring decisions unless a relevant legal exception applies..legislation.gov

United States

In the US, employers may obtain criminal-history information, but they must comply with federal, state, and local requirements. Rather than applying a blanket “any record means no job” approach, employers should assess the nature of the offence, how long ago it occurred, and its relevance to the role.

Many states and cities have adopted “ban-the-box” or fair-chance hiring rules. These laws may restrict when an employer can ask about criminal history, often delaying the question until later in the recruitment process or after a conditional offer. Employers should also check applicable FCRA requirements when using a third-party screening provider, as well as state and local rules that may limit the use of arrest records or older convictions. The EEOC enforces federal laws that prohibit employment discrimination, including discriminatory use of criminal-history information.

Jurisdiction	Can you check criminal records?	The key constraint
Romania	Only where a law requires it for the role	Article 10 GDPR; fines for unjustified requests
UK	Yes, via DBS, by role eligibility	Exceptions Order + Rehabilitation of Offenders Act
US	Yes	EEOC individualized assessment + ban-the-box timing

Can employers inquire about a candidate’s social media presence?

You can look at what’s genuinely public. Whether you should, and what you’re allowed to do with it, is the harder question.

Regardless of the specific legal label used in each country, the underlying risk is essentially the same: social media exposes exactly the information you’re not allowed to base a hiring decision on. Age, religion, ethnicity, health, political views, pregnancy, sexual orientation. Once this information has been seen, it cannot be “unseen,” and if a rejected candidate suspects that these factors influenced the decision, the employer may face legal and reputational challenges.

In Romania and the UK, the GDPR principles of relevance and data minimisation apply to social media just like any other source, and a casual scroll through someone’s private life fails the proportionality test fast. In the US, the exposure is mainly discrimination law, plus a patchwork of state rules, some of which protect lawful off-duty conduct or bar employers from demanding social media passwords.

If you do it at all: keep it narrow, document why it’s relevant to the role, look only at professional or clearly public content, and tell the candidate you’re doing it. It is recommended to make job-relevant checks.

How far back can employers check an applicant’s employment history?

There’s not a standard recommended number, and it depends a lot on the role that you are hiring for.

In Romania and the UK, there’s no fixed statutory limit on how far back you can verify employment history itself. The governing principle is proportionality. Three to seven years covers most roles; reaching back two decades for a junior position is hard to justify.

The US takes a more prescriptive approach in some areas. The FCRA and various state laws set lookback limits for certain reportable items, including the well-known “seven-year rule” for some information. However, higher-salary roles and certain types of records follow different rules, and requirements vary by state. Employment history verification usually depends on relevance, while reporting adverse items requires closer attention to applicable time limits.

A useful rule for all three contexts is to align the depth of the background check with the seniority level and risk associated with the role. For example, a Chief Financial Officer and a temporary warehouse worker do not require the same level of scrutiny, and treating them as if they do is neither efficient nor legally defensible.

Can employers verify a candidate’s educational background?

Yes, and honestly, you probably should. Qualification fraud is one of the most common forms of CV embellishment, from inflated grades to invented degrees and certificates.

Verification usually means going direct to the issuing institution, or using a screening partner that does. In all three countries this is legitimate and expected, provided you have the candidate’s cooperation and you handle the data properly. For international qualifications (increasingly normal with cross-border hiring), you may need credential evaluation or apostille steps, which take longer, so build that into your timeline.

One thing that we recommend is to verify the qualification that actually matters for the role. Confirming a required professional certification is proportionate.

Are there roles that require stricter screening?

Definitely. Some sectors carry legal or regulatory screening duties well beyond the norm, and the list is broadly similar across the three countries even where the specific rules differ. Expect heightened requirements for roles in:

• Finance and banking, where fit-and-proper and integrity checks are standard and regulators expect them.
• Healthcare, where patient safety and, in the US, exclusion-list checks come into play.
• Education and childcare, where working with minors triggers the strictest criminal and barring checks (the UK’s Enhanced DBS with barred lists is the clearest example).
• Security, transport, and safety-critical roles, where a clean record and specific certifications are often legally required.
• Public sector and roles needing security clearance.

In the UK, eligibility to carry out a Standard or Enhanced DBS check is determined by the Exceptions Order. Romanian professional regulations, meanwhile, specify the circumstances in which a criminal record certificate (cazier judiciar) is required. In the US, industry-specific rules for sectors such as financial services and healthcare apply alongside the broader FCRA and EEOC framework.

Also we will like to add that for lower-risk roles, avoid the temptation to conduct more screening than is necessary for the role. Applying a heavy, intrusive process to a job that doesn’t warrant it is a compliance risk in Europe and a discrimination risk in the US. And consistency counts, screen everyone applying for the same position the same way.

Communicating Screening to Candidates

CClear communication is essential to a transparent screening process. It is also a legal requirement in the US, UK, and Romania—and often the point at which candidate trust is either built or lost.

Explain What Will Be Checked

Candidates should be told:

• Which checks will be carried out
• Why the checks are necessary, including their purpose and legal basis
• What personal data will be collected
• How long that data will be retained
• What rights they have in relation to their information

In Romania and the UK, this information should be included in a clear privacy notice and, where appropriate, in the consent documentation. In the US, the FCRA requires a standalone written disclosure and the candidate’s authorisation before a consumer report is obtained.

Follow the US Adverse-Action Process

If screening results may lead to a negative hiring decision in the US, employers must follow a two-step adverse-action process. First, they must send a pre-adverse-action notice, including a copy of the report, a Summary of Rights, and sufficient time for the candidate to respond. Only then may they issue a final adverse-action notice.

Give Candidates a Chance to Respond

If a potentially concerning result appears: such as a mistaken-identity record or an inconsistency relating to previous employment, give the candidate an opportunity to explain before making a decision.

This is a formal requirement within the US adverse-action process and a fair practice in every jurisdiction. It can prevent decisions based on incomplete, inaccurate, or outdated information.

Apply a Consistent Policy

Employers should use a clear, written screening policy and apply it consistently to every candidate considered for the same role. Consistency helps demonstrate that decisions are objective, proportionate, and non-discriminatory if they are ever challenged.

Protect the Candidate Experience

When handled openly and respectfully, screening does not have to damage the candidate experience. Most candidates expect reasonable pre-employment checks; a transparent process instead signals that the organisation is professional, fair, and trustworthy.

Screening across three rulebooks at once

Getting background screening right across Romania, the UK, and the US means navigating three distinct regulatory frameworks: GDPR and Law 190/2018 in Romania, the DBS and UK GDPR in the United Kingdom, and the FCRA along with an evolving landscape of ban-the-box laws in the United States. When done correctly, you can hire with confidence. When mishandled, however, you risk fines, legal disputes, or ending up with a problematic hire you could have identified in advance.

That’s the work we do at Mindit Consulting. We’ve handled background screening and HR compliance for employers across Romania, Europe and the UK 2013, building processes that are thorough, proportionate, and compliant in the market you hire in. If you’d like a new review of your screening policy, or if you’re expanding into a new jurisdiction and want to ensure compliance from the start, we’d be happy to discuss how we can help.
Reach us at office@mindit.ro or visit mindit.ro.

General guidance, not legal advice. Regulations change and local specifics vary, so confirm the details for your roles and locations before acting.